5 ms·

It might still take some time to show up in search, but if you visit https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&mt=8 https://itunes.apple.com/u

by zx2c4 8y ago

It might still take some time to show up in search, but if you visit https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&mt=8 https://itunes.apple.com/us/app/wireguard/id1441195209?ls=1&... on iOS, it should take you to the right place in the App Store.

shshhdhs 8y ago
Awesome! Thanks for the hard work! I’ll give this a go and submit a bug report if I find an issue :-)
iampims 8y ago
I couldn’t find the reasoning behind using Go for the “API”, would you mind sharing some thoughts on the subject?
- tpankaj 8y ago
  I believe another contributor wrote a Go user-space implementation and Jason decided to build off that for the PC user-space implementations and Android and iOS. So basically, because it was there.
yardstick 8y ago
Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.
- cyphar 8y ago
  That is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.
  - dcbadacd 8y ago
    I for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.
  - mbreese 8y ago
    I could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page. Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked. I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.
    - zamadatix 8y ago
      I can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.
    - ownagefool 8y ago
      You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.
doublepg23 8y ago
You maintain pass to? Damn, thanks for your hard work on both!
- aesh2Xa1 8y ago
  He's the original author (not just maintainer).

by zx2c4 8y ago

shshhdhs 8y ago

Awesome! Thanks for the hard work! I’ll give this a go and submit a bug report if I find an issue :-)

iampims 8y ago

I couldn’t find the reasoning behind using Go for the “API”, would you mind sharing some thoughts on the subject?

tpankaj 8y ago
I believe another contributor wrote a Go user-space implementation and Jason decided to build off that for the PC user-space implementations and Android and iOS. So basically, because it was there.

yardstick 8y ago

Any plans for 2FA/MFA? A lot of businesses these days prefer or even require it for remote access. That would then make WireGuard a good alternative to OpenVPN in those environments.

cyphar 8y ago
That is something that would be built on top of WireGuard. I think some people are working on such projects, but the whole point of WireGuard "core" is that it's incredibly minimal in what it does.
- dcbadacd 8y ago
  I for one applaud that. Strongswan and OpenVPN both have so much legacy cruft it's hard to make sure the VPN is secure - that the OSs implementation isn't incredibly out-of-date and I haven't made grave configuration mistakes, not even talking about how much harder Strongswan is to configure compared to Wireguard.
- mbreese 8y ago
  I could see the server side effectively operating like a public wifi hotspot and force all routing to a disclaimer type page. Then you could implement the 2FA there (or even proper username/password logins, which seems weird for WireGuard). If you enter the correct 2FA code, then your IP is no longer blocked. I know phones (and computers) can handle this when connecting to a new WiFi SSID, but do they also run their check when connecting over VPN? I might have to try that.
  - zamadatix 8y ago
    I can confirm automatic captive portals work on most wired devices. Those that don't will have to go to http://example.com http://example.com or similar to be redirected. Word of warning for anyone that implements this: your DNS portal needs to be internal and captive as well.
  - ownagefool 8y ago
    You could write a web portal that generate the wireguard configs on the server and offers the user the client config as a download. The portal then can hook upto to SAML / OIDC endpoint, use claims / groups / roles to offer specific profile configurations and you treat the keys in the configs as temporary tokens, as you attach an empiry time to the profile such as 8 hours, so your devs need to download a new configuration every day. I have a portal that does this for openvpn: https://github.com/secureweb/openvpn-portal https://github.com/secureweb/openvpn-portal The code quality isn't great as it's my hello world golang project, but I think the idea is fairly sound.

doublepg23 8y ago

You maintain pass to? Damn, thanks for your hard work on both!

aesh2Xa1 8y ago
He's the original author (not just maintainer).